High, CVSS 8.7PyPIAmendedPublished
Flawfinder output manipulation via untrusted filenames and source text
CVE-2026-48813 · GHSA-4c3c-r6p8-c863
- Affected
- PyPI flawfinder < 2.0.20
- Fixed in
- 2.0.20· Vendor fix available
- Issue
- Impact This vulnerability is an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection: Terminal Output Spoofing: A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. For example, this might allow an attacker to hide critical scan results, falsely making it appear to a human reviewer that no security issues were found. CSV and XML Injection: Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via outputsonar(). It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents. The initial filename injection problem was reported by Dan Lenz https://www.linkedin.com/in/dan-lenz/ The…
Recommended action: Upgrade to 2.0.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.